Export limit exceeded: 404862 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (404862 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108890 | 1 Blackbelttechnology | 1 Pi-agent-dashboard | 2026-10-12 | 6.3 Medium |
| A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-109188 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries. | ||||
| CVE-2026-109187 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 6.5 Medium |
| jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked. | ||||
| CVE-2026-109186 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 8.8 High |
| jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover. | ||||
| CVE-2026-109185 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 8.8 High |
| jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles. | ||||
| CVE-2026-109184 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant. | ||||
| CVE-2026-109183 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries. | ||||
| CVE-2026-109182 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances. | ||||
| CVE-2026-109181 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills. | ||||
| CVE-2026-109180 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant. | ||||
| CVE-2026-109179 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 4.3 Medium |
| jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions. | ||||
| CVE-2026-109178 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 5.4 Medium |
| jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity. | ||||
| CVE-2026-109177 | 1 Mogublog Project | 1 Mogublog | 2026-10-12 | 4.3 Medium |
| MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders. | ||||
| CVE-2026-109176 | 1 Mogublog Project | 1 Mogublog | 2026-10-12 | 5.4 Medium |
| MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO. | ||||
| CVE-2026-109175 | 1 Mogublog Project | 1 Mogublog | 2026-10-12 | 4.3 Medium |
| MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs. | ||||
| CVE-2026-109174 | 1 Mogublog Project | 1 Mogublog | 2026-10-12 | 6.5 Medium |
| MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords. | ||||
| CVE-2026-109168 | 1 Tangyh | 1 Lamp-cloud | 2026-10-12 | 6.5 Medium |
| lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file. | ||||
| CVE-2026-105081 | 1 Imagemagick | 1 Imagemagick | 2026-10-12 | 3.6 Low |
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy. | ||||
| CVE-2026-108889 | 1 Yungengxin | 1 Cloud Billing | 2026-10-12 | 4.4 Medium |
| A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105407 | 1 Dassault Systèmes | 1 Tuleap Enterprise Edition | 2026-10-12 | 8.8 High |
| An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server. | ||||